source: trunk/include/picture_comment.inc.php @ 2053

Last change on this file since 2053 was 2030, checked in by rub, 17 years ago

Resolved issue 0000702: Code Injection with picture comment

  • Property svn:eol-style set to LF
  • Property svn:keywords set to Author Date Id Revision
File size: 5.8 KB
Line 
1<?php
2// +-----------------------------------------------------------------------+
3// | PhpWebGallery - a PHP based picture gallery                           |
4// | Copyright (C) 2002-2003 Pierrick LE GALL - pierrick@phpwebgallery.net |
5// | Copyright (C) 2003-2007 PhpWebGallery Team - http://phpwebgallery.net |
6// +-----------------------------------------------------------------------+
7// | file          : $Id: picture_comment.inc.php 2030 2007-06-07 18:50:25Z rub $
8// | last update   : $Date: 2007-06-07 18:50:25 +0000 (Thu, 07 Jun 2007) $
9// | last modifier : $Author: rub $
10// | revision      : $Revision: 2030 $
11// +-----------------------------------------------------------------------+
12// | This program is free software; you can redistribute it and/or modify  |
13// | it under the terms of the GNU General Public License as published by  |
14// | the Free Software Foundation                                          |
15// |                                                                       |
16// | This program is distributed in the hope that it will be useful, but   |
17// | WITHOUT ANY WARRANTY; without even the implied warranty of            |
18// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      |
19// | General Public License for more details.                              |
20// |                                                                       |
21// | You should have received a copy of the GNU General Public License     |
22// | along with this program; if not, write to the Free Software           |
23// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
24// | USA.                                                                  |
25// +-----------------------------------------------------------------------+
26
27/**
28 * This file is included by the picture page to manage user comments
29 *
30 */
31
32// the picture is commentable if it belongs at least to one category which
33// is commentable
34$page['show_comments'] = false;
35foreach ($related_categories as $category)
36{
37  if ($category['commentable'] == 'true')
38  {
39    $page['show_comments'] = true;
40    break;
41  }
42}
43
44if ( $page['show_comments'] and isset( $_POST['content'] ) )
45{
46  if ( is_a_guest() and !$conf['comments_forall'] )
47  {
48    die ('Session expired');
49  }
50
51  $comm = array(
52    'author' => trim( stripslashes(@$_POST['author']) ),
53    'content' => trim( stripslashes($_POST['content']) ),
54    'image_id' => $page['image_id'],
55   );
56
57  include_once(PHPWG_ROOT_PATH.'include/functions_comment.inc.php');
58 
59  $comment_action = insert_user_comment($comm, @$_POST['key'], $infos );
60
61  switch ($comment_action)
62  {
63    case 'moderate':
64      array_push( $infos, l10n('comment_to_validate') );
65    case 'validate':
66      array_push( $infos, l10n('comment_added'));
67      break;
68    case 'reject': 
69      set_status_header(403);
70      array_push($infos, l10n('comment_not_added') );
71      break;
72    default:
73      trigger_error('Invalid comment action '.$comment_action, E_USER_WARNING);
74  }
75
76  foreach ($infos as $info)
77  {
78    $template->assign_block_vars(
79        'information',
80        array( 'INFORMATION'=>$info )
81      );
82  }
83
84  // allow plugins to notify what's going on
85  trigger_action( 'user_comment_insertion',
86      array_merge($comm, array('action'=>$comment_action) )
87    );
88}
89
90
91if ($page['show_comments'])
92{
93  // number of comment for this picture
94  $query = 'SELECT COUNT(*) AS nb_comments';
95  $query.= ' FROM '.COMMENTS_TABLE.' WHERE image_id = '.$page['image_id'];
96  $query.= " AND validated = 'true'";
97  $query.= ';';
98  $row = mysql_fetch_array( pwg_query( $query ) );
99
100  // navigation bar creation
101  if (!isset($page['start']))
102  {
103    $page['start'] = 0;
104  }
105
106  $page['navigation_bar'] = create_navigation_bar(
107    duplicate_picture_url(array(), array('start')),
108    $row['nb_comments'],
109    $page['start'],
110    $conf['nb_comment_page'],
111    true // We want a clean URL
112    );
113
114  $template->assign_block_vars(
115    'comments',
116    array(
117      'NB_COMMENT' => $row['nb_comments'],
118      'NAV_BAR' => $page['navigation_bar'],
119      )
120    );
121
122  if ($row['nb_comments'] > 0)
123  {
124    $query = '
125SELECT id,author,date,image_id,content
126  FROM '.COMMENTS_TABLE.'
127  WHERE image_id = '.$page['image_id'].'
128    AND validated = \'true\'
129  ORDER BY date ASC
130  LIMIT '.$page['start'].', '.$conf['nb_comment_page'].'
131;';
132    $result = pwg_query( $query );
133
134    while ($row = mysql_fetch_array($result))
135    {
136      $template->assign_block_vars(
137        'comments.comment',
138        array(
139          'COMMENT_AUTHOR' => trigger_event('render_comment_author', 
140            empty($row['author'])
141            ? l10n('guest')
142            : $row['author']),
143
144          'COMMENT_DATE' => format_date(
145            $row['date'],
146            'mysql_datetime',
147            true),
148
149          'COMMENT' => trigger_event('render_comment_content',$row['content']),
150          )
151        );
152
153      if (is_admin())
154      {
155        $template->assign_block_vars(
156          'comments.comment.delete',
157          array(
158            'U_COMMENT_DELETE' =>
159              add_url_params(
160                    $url_self,
161                    array(
162                      'action'=>'delete_comment',
163                      'comment_to_delete'=>$row['id']
164                    )
165                )
166            )
167          );
168      }
169    }
170  }
171
172  if (!is_a_guest()
173      or (is_a_guest() and $conf['comments_forall']))
174  {
175    include_once(PHPWG_ROOT_PATH.'include/functions_comment.inc.php');
176    $key = get_comment_post_key($page['image_id']);
177    $content = '';
178    if ('reject'===@$comment_action)
179    {
180      $content = htmlspecialchars($comm['content']);
181    }
182    $template->assign_block_vars('comments.add_comment',
183        array(
184          'KEY' => $key,
185          'CONTENT' => $content
186        ));
187
188    // display author field if the user status is guest or generic
189    if (!is_classic_user())
190    {
191      $template->assign_block_vars(
192        'comments.add_comment.author_field', array()
193        );
194    }
195  }
196}
197
198?>
Note: See TracBrowser for help on using the repository browser.